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" The MAILING DATE of this communication app ars on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the OfTice later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )I3 Responsive to communication(s) filed on 25 March 2004 . 
2b)\3 This action is FINAL. 2b)S This action is non-final. 

3) n Since this application is in condition for allowance except for fomnal matters, prosecution as to the merits is 

closed in accordance with the practice under £x parte Quay/e, 1935 CD. 11,453 O.G.213. 

Disposition of Claims 

4) 13 Claim(s) 1-15 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) M Claim(s) 7-75 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8) 0 Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) M The specification is objected to by the Examiner. 

10)0 The drawing(s) filed on is/are: 3)0 accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

Replacement drawing sheet{s) including the connection is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or fomri PTO-152. 

Priority under 35 U.S.C. § 119 

12)0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)n All b)n Some * 0)0 None of: 

1 .□ Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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2) CH Notice of Draftsperson's Patent Drawing Review (PTO-948) 
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5) □ Notice of Informal Patent Application (PTO-152) 

6) □ Other: . 



U.S. Patent and Trademark Office 

PTOL-326 (Rev. 1-04) 
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Part of Paper No./Mail Date 20040614 
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DETAILED ACTION 
Status of Claims 

1. This action is in response to the amendment received on 25 March 2004. 

2. Claims 1-15 have been examined. 

3. The rejections of claims 1-15 are unchanged except for correction of 
typographical errors, which does not alter the rejections of the limitations 
contained within claims 1-15. 



RESPONSE TO ARGUMENTS 

4- Applicant's arguments received on 25 March 2004 have been fully 
considered but they are not persuasive. Referring to the previous Office 
action. Examiner has cited relevant portions of the references as a means 
to illustrate the systems as taught by the prior art. As a means of 
providing further clarification as to what is taught by the references used in 
the first Office action. Examiner has expanded the teachings for 
comprehensibility while maintaining the same grounds of rejection of the 
claims, except as noted above in the section labeled "Status of Claims." 
This information is intended to assist in illuminating the teachings of the 
references while providing evidence that establishes further support for 
the rejections of the claims. 
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5. With regard to the rejection of claims 1-5 35 U.S.C. 101, Applicant argues 
that this is an improper rejection. However, as stated in MPEP 2106 II.A, 
when a claim is devoid of technological application, it should be rejected. 

With regard to claims 1, 6, and 11, Applicant argues that that prior 
art of record does not teach or suggest all of the claim limitations. The 
Examiner respectfully disagrees and maintains the rejections as shown 
below. Combining the privacy agreement of King with Kroenke's relational 
diagrams teaches the limitation in question. Taken together, as intended 
by the Examiner and not in a piecemeal fashion, the combination of 
King/Kroenke teaches the limitations of independent claims 1 , 6, and 1 1 . 



Specification 

6. The disclosure is objected to because it contains an embedded hyperlink 
and/or other form of browser-executable code on page 7, line 8. Applicant 
is required to delete the embedded hyperlink and/or other form of browser- 
executable code. See MPEP § 608.01 . 



Claim Rejections - 35 USC § 101 



7. 35 U.S.C. 1 01 reads as follows: 



Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent 
therefor, subject to the conditions and requires of this title. 
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8. Claims 1-5 are rejected under 35 U.S.C. 101 because the claimed 
invention is directed to nonstatutory subject matter. The basis of this 
rejection is set forth in a two-prong test of: 

(1 ) whether the invention is within the technological arts; and 

(2) whether the invention produces a useful, concrete, and tangible 
result. 

For a claimed invention to be statutory, the claimed invention must 
be within the technological arts. Mere ideas in the abstract (i.e., abstract 
idea, law of nature, natural phenomena) that do not apply, involve, use, or 
advance the technological arts fail to promote the "progress of science 
and the useful arts" (i.e., the physical sciences as opposed to social 
sciences, for example) and therefore are found to be non-statutory subject 
matter. For a process claim to pass muster, the recited process must 
somehow apply, involve, use, or advance the technological arts. 

In the present case, the recited steps of merely improving the 
handling of personally identifiable information by identifying the parties 
involved, identifying the data involved, classifying the data, and expressing 
each relationship, do not apply, involve, use, or advance the technological 
arts since all of the recited steps can be performed without the use of any 
technological apparatus, system or method such as, for example, a 
computer system, database, electronic circuit, or software application. 
These steps only constitute a method that is easily attainable without the 
use of any state-of-the-art devices or techniques. As written, the steps and 
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system components recited in the claim language could easily be 
implemented by using a pencil and paper by one of ordinary skill in the art. 

Claim Rejections - 35 USC § 103 

9. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 102 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

10- Claims 1, 2, 6, 7, 11, and 12 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over King (EP 1,081,916 A2), in view of Kroenke, 
"Database Processing: Fundamentals, Design, and 
lmplementation"(c)1999, and further in view of Spies et al. (US 5,689,565). 
Claims 1, 6, and 11: 

King as shown, discloses the following limitations: 

• identifying tlie parties involved in a process of liandling 
personally identifiable information (page 4, lines 30-31); 

• identifying the data involved in said process (page 4, lines 
42-43); 

• classifying the data (page 5, lines 50-51 ); 

• expressing each relationship between each pair of said 
parties in terms of a privacy agreement (page 4, lines 30- 
31); 
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• said privacy agreement is specific to a single purpose (page 
8, lines 1-50). 

• said privacy agreement expresses rules regarding said 
privacy-related actions, for each of said parties (abstract); 

King does not specifically disclose the following limitations, but 
Kroenke, as shown does. 

• representing said parties, said data, and said privacy 
agreements graphically in one or more privacy agreement 
relationship diagrams (Figures 3-3 to 3-1 1 ), wherein: 

• said privacy agreement uses a limited number of privacy- 
related actions concerning said personally identifiable 
information (Figure 3-15); 

It would have been obvious to one of ordinary skill in the art at the 
time of the invention to combine King's method and system for exchanging 
sensitive information with Kroenke's relational database management 
system because the RDBMS allows entities and classes each with their 
own attributes to be modeled in relation to each other so as to form a 
construct that relies relationships and rules that would permit the use, 
access, and modification of sensitive personal information quickly and 
easily, as well as securely. 
Claims 2, 7, and 12: 

King discloses exchanging sensitive information as shown above. 
King does not specifically disclose mapping a business process to the 
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privacy rules that should govern the behavior of each pair of parties. 
However, Kroenke discloses entity relationship diagrams that show 
cardinality between classes and entities (see at leas Figures 3-3). 
Kroenke also discloses that there are many different ways of modeling a 
business situation using the relational data base environment (page 67). 
It would have been obvious to one of ordinary skill in the art at the time of 
the invention to combine King's method and system for exchanging 
sensitive information with Kroenke's relational database management 
system because the RDBMS allows entities and classes each with their 
own attributes to be modeled in relation to each other so as to form a 
construct that relies relationships and rules that would permit the use, 
access, and modification of sensitive personal information quickly and 
easily, as well as securely. 



11. Claims 3-5, 8-10, and 13-15 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over King (EP 1,081,916 A2), in view of Kroenke, "Database 
Processing: Fundamentals, Design, and lmplementation"(c)1999, and 
further in view of Spies et al. (US 5,689,565). 
Claims 3-5, 8-10, and 13-15: 

King discloses exchanging sensitive information as shown above. 
King does not specifically disclose mitigating the risks associated with 
handling sensitive information. Spies, however, in column 1, lines 26-29, 
states, "To provide a secure interchange of information in the electronic 
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arena, one traditional approach to mitigating the risk of having sensitive 
information intercepted was to institute proprietary computerized systems 
that were closed to the general public." Although Spies does not 
specifically teach identifying opportunities to reduce privacy-related risks 
involved in said process, identifying unnecessary exchanges of data for 
possible elimination, and identifying opportunities to transform data into a 
less sensitive form, Spies shows that mitigating risk associated with 
personal, sensitive information has been addressed by reducing and 
restricting the access that individuals and organizations have private data. 
Identifying opportunities to reduce the risk by reducing unnecessary 
changes to the data and transforming data into a less sensitive form are 
obvious ways of mitigating the risk of inadvertently releasing sensitive 
information into the hands of persons who are not authorized access to 
such a data. Spies, as shown above, foresees this risk and accomplishes 
the same resolution under the umbrella of reducing the exposure of 
sensitive information to authorized personnel. 
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Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to James A. 
Reagan whose telephone number is (703) 306-9131. The examiner can 
normally be reached on Monday-Friday, 9:30am-5:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, 
the examiner's supervisor, James Trammell can be reached at (703) 305- 
9768. 

Any inquiry of a general nature or relating to the status of this 
application or proceeding should be directed to the Receptionist whose 
telephone number is (703) 305-3900. 

Any response to this action should be mailed to: 
Commissioner of Patents and Trademarks 

Washington, D.C. 20231 

or faxed to: 

(703) 305-7687 [Official communications; including 

After Final communications labeled "Box AF"] 
(703)308-1396 [Informal/Draft communications, labeled 
"PROPOSED" or "DRAFT"] 
Hand delivered responses should be brought to Crystal Park 5, 2451 
Crystal Drive, Arlington, VA, 7^ floor receptionist. 
JAR 

14 June 2004 




